You have compromised a domain admin account and want to maintain persistence even if the domain admin password is changed. You also want to avoid detection by the security team that monitors changes to privileged groups. Which technique should you use?

Modify the adminSDHolder ACL to grant yourself full control over all protected groups.

Use a golden ticket with a long validity period.

Create a new domain admin account and add it to the Domain Admins group.

Install a skeleton key on the domain controller.

You have compromised a user account that has 'GenericAll' permission on a group that contains domain admins. You need to gain domain admin privileges. Which technique should you use?

Use a silver ticket for the domain admin group.

Use DCSync to replicate the domain and extract hashes.

Use Kerberoasting to extract a service account hash.

Add your compromised account to the domain admins group using the GenericAll permission.

What is the main difference between unconstrained and constrained delegation?

Constrained delegation allows impersonation of any user, while unconstrained delegation only allows impersonation of service accounts

Constrained delegation requires the KRBTGT hash, while unconstrained delegation does not

Unconstrained delegation allows a service to impersonate users on any service, while constrained delegation limits impersonation to specific services

Unconstrained delegation is used for Kerberos, while constrained delegation is used for NTLM

Which process on a domain controller is typically targeted in a skeleton key attack?

LSASS (Local Security Authority Subsystem Service)

Kerberos Key Distribution Center service (KDC)

Active Directory Web Services (ADWS)

You have gained administrative access to a domain controller. You want to maintain access to the domain by allowing any user to authenticate with a single password, but you need to avoid leaving a persistent file on disk that could be detected by antivirus. Which technique should you use?

Create a new domain admin account and add it to the Domain Admins group.

Install a skeleton key in the LSASS process on the domain controller.

Forge a golden ticket using the KRBTGT hash.

Modify the adminSDHolder ACL to grant yourself full control.

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 2)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 6–10

6expert · hard
You have compromised a domain admin account and want to maintain persistence even if the domain admin password is changed. You also want to avoid detection by the security team that monitors changes to privileged groups. Which technique should you use?
Select an answer first
7application · medium
You have compromised a user account that has 'GenericAll' permission on a group that contains domain admins. You need to gain domain admin privileges. Which technique should you use?
Select an answer first
8foundation · easy
What is the main difference between unconstrained and constrained delegation?
Select an answer first
9foundation · easy
Which process on a domain controller is typically targeted in a skeleton key attack?
Select an answer first
10expert · hard
You have gained administrative access to a domain controller. You want to maintain access to the domain by allowing any user to authenticate with a single password, but you need to avoid leaving a persistent file on disk that could be detected by antivirus. Which technique should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.